Detecting domain‐flux botnet based on DNS traffic features in managed network

Abstract

Modern botnets such as Zeus and Conficker commonly utilize a technique called domain fluxing or a domain generation algorithm to generate a large number of pseudo‐random domain names (PDNs) dynamically for botnet operators to control their bots. These botnets are becoming one of the most serious threats to Internet security on a global scale. How to prevent their destructive action is one of the most pressing issues of today. In this paper, we focus on detecting domain‐flux botnets within the monitored network based on Domain Name System (DNS) traffic features. This method passively captures all DNS traffic from the gateway of a monitored network and then extracts key features to identify PDN. Based on examining and analyzing a large number of legitimate domains as well as PDN generated by botnets, we have discovered that there is a discernible bias in the rules for constructing domain names. Therefore, we introduce a methodology that analyzes DNS traffic to extract the length and the expected value, which can distinguish between a domain name generated by humans or bots. In order to evaluate the effectiveness of the proposed approach, various machine learning algorithms are applied to train predictive models for our detection system. This proposed scheme is implemented and tested in a real local area network. The experimental results show that our proposed method achieves the highest detective efficiency for decision tree algorithms (J48) with an average overall accuracy of up to 92.3% and a false positive rate of 4.8%. Copyright © 2016 John Wiley & Sons, Ltd.

A Superficial Analysis Approach for Identifying Malicious Domain Names Generated by DGA Malware

“…Based on those results, other previous studies have attempted to distinguish between benign and malicious domains using only their character strings in manners similar to our approach. Truong et al [27] proposed a technique that learns and predicts character patterns using bigram models with supervised learning algorithms, and Anderson et al [28] extended this technique using character-level models with long short-term memory (LSTM) networks. Qiao et al [29] combined LSTM networks with attention mechanisms to give proper weight values to the characters in domain names.…”

“…Notably, the idea of using randomization to facilitate malware detection is not novel. Indeed, several studies based on this strategy have been reported [27], [28], [29], [30], [38], [39]. For example, Lin et al [38] proposed a method for decrypting malware communications for tracebacks to cybercriminals, while Wahab et al [39] proposed a method for detecting compromised virtual machines by monitoring behavior at the hypervisor level.…”

“…For example, Lin et al [38] proposed a method for decrypting malware communications for tracebacks to cybercriminals, while Wahab et al [39] proposed a method for detecting compromised virtual machines by monitoring behavior at the hypervisor level. Other studies [27], [ [29], [30] have attempted to apply ML or DL algorithms to distinguish between benign and malicious domains by noting the differences in character strings in the same manner as the approach proposed here. However, the cumbersome task of assigning labels to datasets and the discrepancies that arise between training and actual datasets have thus far prevented ML-and DL-based detection methods from exhibiting their full potential performance levels.…”

“…For comparison with the proposed approach, we implemented three techniques for identifying malicious domains from only the domain name string based on [27], [28], and [29]. The specifications of the machine used for implementation are given in Table III.…”

Recommender System based on Empirical Study of Geolocated Clustering and Prediction Services for Botnets Cyber-Intelligence in Malaysia

“…The system is leveraging on the knowledge of the life cycle of malicious domains, as well as the observation of resource re-use across different attacks. Another similar work by Truong & Cheng, where they proposed a method to detect Zeus and Conficker that utilizes domain fluxing by analyzing the extracted the DNS traffic length and expected value that can distinguish between a domain name, by a human or botnets [5]. Nguyen & Tran on the other hand, modeled user behaviors and applying heuristic analysis approach to mobile logs generated during device operation process [7].…”